Dovecot loads the CPU

Problem: According to the customer: the web server is slow and has many httpd processes (more than 400). Symptoms:

Apache does indeed show many processes, but external client activity is low. Check CPU usage:

Check what Dovecot is doing:

Count files in the mail store and observe constant growth despite no external traffic in Exim.

-bash-4.1# find /var/...mail/domain.com/ -type f | wc -l
679728
# ... 3 sec
679747
# ... 3 sec
679754
# ... 3 sec
679758
# ... 3 sec
679767

Find the mailbox where the number of messages is growing (by elimination). Number of messages in the mailbox: 564,314. Number of messages in the first INBOX folder: more than 220,000.

Stop Dovecot. Delete all dovecot* files from every folder of this mailbox:

../support/.maildir/dovecot.index
../support/.maildir/dovecot.index.cache
../support/.maildir/dovecot.index.log
../support/.maildir/dovecot.mailbox.log
../support/.maildir/dovecot-uidlist
../support/.maildir/dovecot-uidvalidity

Start Dovecot. Log in to the mail using the web client and check message visibility—everything is OK. When a client accesses a folder, Dovecot recreates the files deleted earlier. This takes some time and causes a small amount of I/O load.

NO CPU load from Dovecot processes.

Continuation: The next day, the customer noticed that incoming mail for the mailbox that had issues yesterday was not sorted into folders. The server has the ISP panel installed. Mail sorting is performed by Procmail. This mailbox had 15 rules.

Enabled the Procmail debug log.

$ cat /etc/procmailrc
...
LOGFILE="/var/log/procmail/procmail.log"
DEBUG=yes
VERBOSE=yes
...

Wait for the problem to recur.